medium6.9
CVE-2026-45076
Synapse is an open source Matrix homeserver implementation.
Impact
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | matrix-synapse | < 1.152.1 | 1.152.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Element | Synapse | before 1.152.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-6qf2-7x63-mm6v
- https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-45076
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2026-194.yaml